AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-17
CVE-2025-14444: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 – Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment (custom-registration-form-builder-with-submission-manager)
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the…
2026-02-17
CVE-2026-2426: WP-DownloadManager <= 1.69 – Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter (wp-downloadmanager)
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete…
2026-02-17
CVE-2026-1508 (court-reservation)
Atomic Edge analysis of CVE-2026-1508 (metadata-based): This vulnerability affects the Court Reservation WordPress plugin. The CVE metadata lacks classification details, preventing definitive categorization. Atomic Edge research indicates this likely involves a server-side security flaw in plugin functionality. Without CWE or CVSS data, severity assessment relies on typical WordPress plugin vulnerability patterns. Root cause analysis depends…
2026-02-16
CVE-2026-22356: Jetpack CRM <= 6.7.0 – Unauthenticated Local File Inclusion (zero-bs-crm)
The Jetpack CRM plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 6.7.0. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive…
2026-02-16
CVE-2026-22357: Link Whisper Free <= 0.9.0 – Reflected Cross-Site Scripting (link-whisper)
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
2026-02-16
CVE-2026-25368: Calculated Fields Form <= 5.4.4.1 – Missing Authorization (calculated-fields-form)
The Calculated Fields Form plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.4.4.1. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
2026-02-16
CVE-2026-22354: Woocommerce Category Banner Management <= 2.5.1 – Authenticated (Contributor+) PHP Object Injection (banner-management-for-woocommerce)
The Woocommerce Category Banner Management plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a…
2026-02-16
CVE-2025-68002: Open User Map <= 1.4.16 – Authenticated (Subscriber+) Arbitrary File Download (open-user-map)
The Open User Map plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
2026-02-16
CVE-2026-2001: WowRevenue <= 2.1.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (revenue)
The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code…
2026-02-16
CVE-2025-12062: WP Maps <= 4.8.6 – Authenticated (Subscriber+) Limited Local File Inclusion (wp-google-map-plugin)
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.